Merge pull request #53144 from mikedanese/kubelet-revoke

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. gce: revoke kubelet binding permissions and move the binding addon to EnsureExists, so new clusters will pickup the new binding and old clusters will keep the old binding. The binding is no longer required now that we are migrating to node authorizer. fixes https://github.com/kubernetes/kubernetes/issues/53151

Merge pull request #53144 from mikedanese/kubelet-revoke
8eb0b39a · Kubernetes Submit Queue · GitHub · 3b4424ce · 3f7e1ccc · 8eb0b39a
Unverified Commit 8eb0b39a authored Nov 07, 2017 by Kubernetes Submit Queue Committed by GitHub Nov 07, 2017
6 changed files
--- a/cluster/addons/rbac/kube-apiserver-kubelet-api-admin-binding.yaml
+++ b/cluster/addons/rbac/kube-apiserver-kubelet-api-admin-binding.yaml
--- a/cluster/addons/rbac/kubelet-api-admin-role.yaml
+++ b/cluster/addons/rbac/kubelet-api-admin-role.yaml
--- a/cluster/addons/rbac/kubelet-certificate-management.yaml
+++ b/cluster/addons/rbac/kubelet-certificate-management.yaml
--- a/cluster/addons/rbac/legacy-kubelet-user-disable/kubelet-binding.yaml
+++ b/cluster/addons/rbac/legacy-kubelet-user-disable/kubelet-binding.yaml
+# This is required so that old clusters don't remove required bindings for 1.5
+# kubelets to function.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: kubelet-cluster-admin
+  labels:
+    kubernetes.io/cluster-service: "true"
+    addonmanager.kubernetes.io/mode: EnsureExists
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:node
+subjects:
--- a/cluster/addons/rbac/kubelet-binding.yaml
+++ b/cluster/addons/rbac/kubelet-binding.yaml
--- a/cluster/gce/gci/configure-helper.sh
+++ b/cluster/gce/gci/configure-helper.sh
@@ -1768,7 +1768,13 @@ function start-kube-addons {
  local -r dst_dir="/etc/kubernetes/addons"

  # prep addition kube-up specific rbac objects
-  setup-addon-manifests "addons" "rbac"
+  setup-addon-manifests "addons" "rbac/kubelet-api-auth"
+  setup-addon-manifests "addons" "rbac/kubelet-cert-rotation"
+  if [[ "${REGISTER_MASTER_KUBELET:-false}" == "true" ]]; then
+    setup-addon-manifests "addons" "rbac/legacy-kubelet-user"
+  else
+    setup-addon-manifests "addons" "rbac/legacy-kubelet-user-disabled"
+  fi

  if [[ "${ENABLE_POD_SECURITY_POLICY:-}" == "true" ]]; then
      setup-addon-manifests "addons" "podsecuritypolicies"